| # Copyright 2021 syzkaller project authors. All rights reserved. |
| # Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file. |
| |
| # The source file of mali bifrost ioctl can be found in ChromeOS source tree: |
| # https://chromium.googlesource.com/chromiumos/third_party/kernel/+/chromeos-4.19/drivers/gpu/arm/bifrost/mali_kbase_ioctl.h |
| |
| # Not upstream, generated on: |
| # https://chromium.googlesource.com/chromiumos/third_party/kernel d2a8a1eb8b86 |
| meta noextract |
| |
| include <asm/page.h> |
| include <drivers/gpu/arm/bifrost/mali_kbase_debug.h> |
| include <drivers/gpu/arm/bifrost/mali_kbase_hwcnt_reader.h> |
| include <drivers/gpu/arm/bifrost/mali_kbase_ioctl.h> |
| include <drivers/gpu/arm/bifrost/mali_base_kernel.h> |
| include <uapi/linux/fcntl.h> |
| |
| resource fd_bifrost[fd] |
| resource gpu_addr[int64]: BASEP_MEM_INVALID_HANDLE, BASEP_MEM_WRITE_ALLOC_PAGES_HANDLE |
| resource user_addr[int64]: -1 |
| resource fd_fence[fd] |
| resource fd_hwcnt[fd] |
| |
| openat$bifrost(fd const[AT_FDCWD], file ptr[in, string["/dev/bifrost"]], flags flags[open_flags], mode const[0]) fd_bifrost |
| # Device name on Android |
| openat$mali(fd const[AT_FDCWD], file ptr[in, string["/dev/mali0"]], flags flags[open_flags], mode const[0]) fd_bifrost |
| |
| mmap$bifrost(addr const[0], len len[addr], prot flags[mmap_prot], flags flags[mmap_flags], fd fd_bifrost, offset fileoff) user_addr |
| _ = __NR_mmap2 |
| |
| ioctl$KBASE_IOCTL_JOB_SUBMIT(fd fd_bifrost, cmd const[KBASE_IOCTL_JOB_SUBMIT], arg ptr[in, kbase_ioctl_job_submit]) |
| ioctl$KBASE_IOCTL_POST_TERM(fd fd_bifrost, cmd const[KBASE_IOCTL_POST_TERM], arg const[0]) |
| ioctl$KBASE_IOCTL_SOFT_EVENT_UPDATE(fd fd_bifrost, cmd const[KBASE_IOCTL_SOFT_EVENT_UPDATE], arg ptr[in, kbase_ioctl_soft_event_update]) |
| ioctl$KBASE_IOCTL_VERSION_CHECK(fd fd_bifrost, cmd const[KBASE_IOCTL_VERSION_CHECK], arg ptr[inout, kbase_ioctl_version_check]) |
| ioctl$KBASE_IOCTL_SET_FLAGS(fd fd_bifrost, cmd const[KBASE_IOCTL_SET_FLAGS], arg ptr[in, kbase_ioctl_set_flags]) |
| ioctl$KBASE_IOCTL_GET_GPUPROPS(fd fd_bifrost, cmd const[KBASE_IOCTL_GET_GPUPROPS], arg ptr[inout, kbase_ioctl_get_gpuprops]) |
| ioctl$KBASE_IOCTL_MEM_ALLOC(fd fd_bifrost, cmd const[KBASE_IOCTL_MEM_ALLOC], arg ptr[inout, kbase_ioctl_mem_alloc]) |
| ioctl$KBASE_IOCTL_MEM_QUERY(fd fd_bifrost, cmd const[KBASE_IOCTL_MEM_QUERY], arg ptr[inout, kbase_ioctl_mem_query]) |
| ioctl$KBASE_IOCTL_MEM_FREE(fd fd_bifrost, cmd const[KBASE_IOCTL_MEM_FREE], arg ptr[in, kbase_ioctl_mem_free]) |
| ioctl$KBASE_IOCTL_HWCNT_READER_SETUP(fd fd_bifrost, cmd const[KBASE_IOCTL_HWCNT_READER_SETUP], arg ptr[in, kbase_ioctl_hwcnt_reader_setup]) fd_hwcnt |
| ioctl$KBASE_IOCTL_HWCNT_ENABLE(fd fd_bifrost, cmd const[KBASE_IOCTL_HWCNT_ENABLE], arg ptr[in, kbase_ioctl_hwcnt_enable]) |
| ioctl$KBASE_IOCTL_HWCNT_DUMP(fd fd_bifrost, cmd const[KBASE_IOCTL_HWCNT_DUMP], arg const[0]) |
| ioctl$KBASE_IOCTL_HWCNT_CLEAR(fd fd_bifrost, cmd const[KBASE_IOCTL_HWCNT_CLEAR], arg const[0]) |
| ioctl$KBASE_IOCTL_HWCNT_SET(fd fd_bifrost, cmd const[KBASE_IOCTL_HWCNT_SET], arg ptr[inout, kbase_ioctl_hwcnt_values]) |
| ioctl$KBASE_IOCTL_DISJOINT_QUERY(fd fd_bifrost, cmd const[KBASE_IOCTL_DISJOINT_QUERY], arg ptr[out, kbase_ioctl_disjoint_query]) |
| ioctl$KBASE_IOCTL_GET_DDK_VERSION(fd fd_bifrost, cmd const[KBASE_IOCTL_GET_DDK_VERSION], arg ptr[inout, kbase_ioctl_get_ddk_version]) |
| ioctl$KBASE_IOCTL_MEM_JIT_INIT_10_2(fd fd_bifrost, cmd const[KBASE_IOCTL_MEM_JIT_INIT_10_2], arg ptr[in, kbase_ioctl_mem_jit_init_10_2]) |
| ioctl$KBASE_IOCTL_MEM_JIT_INIT_11_5(fd fd_bifrost, cmd const[KBASE_IOCTL_MEM_JIT_INIT_11_5], arg ptr[in, kbase_ioctl_mem_jit_init_11_5]) |
| ioctl$KBASE_IOCTL_MEM_JIT_INIT(fd fd_bifrost, cmd const[KBASE_IOCTL_MEM_JIT_INIT], arg ptr[in, kbase_ioctl_mem_jit_init]) |
| ioctl$KBASE_IOCTL_MEM_SYNC(fd fd_bifrost, cmd const[KBASE_IOCTL_MEM_SYNC], arg ptr[in, kbase_ioctl_mem_sync]) |
| ioctl$KBASE_IOCTL_MEM_FIND_CPU_OFFSET(fd fd_bifrost, cmd const[KBASE_IOCTL_MEM_FIND_CPU_OFFSET], arg ptr[inout, kbase_ioctl_mem_find_cpu_offset]) |
| ioctl$KBASE_IOCTL_GET_CONTEXT_ID(fd fd_bifrost, cmd const[KBASE_IOCTL_GET_CONTEXT_ID], arg ptr[out, kbase_ioctl_get_context_id]) |
| ioctl$KBASE_IOCTL_TLSTREAM_ACQUIRE(fd fd_bifrost, cmd const[KBASE_IOCTL_TLSTREAM_ACQUIRE], arg ptr[in, kbase_ioctl_tlstream_acquire]) |
| ioctl$KBASE_IOCTL_TLSTREAM_FLUSH(fd fd_bifrost, cmd const[KBASE_IOCTL_TLSTREAM_FLUSH], arg const[0]) |
| ioctl$KBASE_IOCTL_MEM_COMMIT(fd fd_bifrost, cmd const[KBASE_IOCTL_MEM_COMMIT], arg ptr[in, kbase_ioctl_mem_commit]) |
| ioctl$KBASE_IOCTL_MEM_ALIAS(fd fd_bifrost, cmd const[KBASE_IOCTL_MEM_ALIAS], arg ptr[inout, kbase_ioctl_mem_alias]) |
| ioctl$KBASE_IOCTL_MEM_IMPORT(fd fd_bifrost, cmd const[KBASE_IOCTL_MEM_IMPORT], arg ptr[inout, kbase_ioctl_mem_import]) |
| ioctl$KBASE_IOCTL_MEM_FLAGS_CHANGE(fd fd_bifrost, cmd const[KBASE_IOCTL_MEM_FLAGS_CHANGE], arg ptr[in, kbase_ioctl_mem_flags_change]) |
| ioctl$KBASE_IOCTL_STREAM_CREATE(fd fd_bifrost, cmd const[KBASE_IOCTL_STREAM_CREATE], arg ptr[in, kbase_ioctl_stream_create]) fd_fence |
| ioctl$KBASE_IOCTL_FENCE_VALIDATE(fd fd_bifrost, cmd const[KBASE_IOCTL_FENCE_VALIDATE], arg ptr[in, kbase_ioctl_fence_validate]) |
| ioctl$KBASE_IOCTL_MEM_PROFILE_ADD(fd fd_bifrost, cmd const[KBASE_IOCTL_MEM_PROFILE_ADD], arg ptr[in, kbase_ioctl_mem_profile_add]) |
| ioctl$KBASE_IOCTL_STICKY_RESOURCE_MAP(fd fd_bifrost, cmd const[KBASE_IOCTL_STICKY_RESOURCE_MAP], arg ptr[in, kbase_ioctl_sticky_resource_map]) |
| ioctl$KBASE_IOCTL_STICKY_RESOURCE_UNMAP(fd fd_bifrost, cmd const[KBASE_IOCTL_STICKY_RESOURCE_UNMAP], arg ptr[in, kbase_ioctl_sticky_resource_unmap]) |
| ioctl$KBASE_IOCTL_MEM_FIND_GPU_START_AND_OFFSET(fd fd_bifrost, cmd const[KBASE_IOCTL_MEM_FIND_GPU_START_AND_OFFSET], arg ptr[inout, kbase_ioctl_mem_find_gpu_start_and_offset]) |
| ioctl$KBASE_IOCTL_MEM_EXEC_INIT(fd fd_bifrost, cmd const[KBASE_IOCTL_MEM_EXEC_INIT], arg ptr[in, kbase_ioctl_mem_exec_init]) |
| ioctl$KBASE_IOCTL_GET_CPU_GPU_TIMEINFO(fd fd_bifrost, cmd const[KBASE_IOCTL_GET_CPU_GPU_TIMEINFO], arg ptr[inout, kbase_ioctl_get_cpu_gpu_timeinfo]) |
| |
| ioctl$KBASE_HWCNT_READER_GET_HWVER(fd fd_hwcnt, cmd const[KBASE_HWCNT_READER_GET_HWVER], arg const[0]) |
| ioctl$KBASE_HWCNT_READER_GET_BUFFER_SIZE(fd fd_hwcnt, cmd const[KBASE_HWCNT_READER_GET_BUFFER_SIZE], arg const[0]) |
| ioctl$KBASE_HWCNT_READER_DUMP(fd fd_hwcnt, cmd const[KBASE_HWCNT_READER_DUMP], arg const[0]) |
| ioctl$KBASE_HWCNT_READER_CLEAR(fd fd_hwcnt, cmd const[KBASE_HWCNT_READER_CLEAR], arg const[0]) |
| ioctl$KBASE_HWCNT_READER_GET_BUFFER(fd fd_hwcnt, cmd const[KBASE_HWCNT_READER_GET_BUFFER], arg ptr[out, kbase_hwcnt_reader_metadata]) |
| ioctl$KBASE_HWCNT_READER_PUT_BUFFER(fd fd_hwcnt, cmd const[KBASE_HWCNT_READER_PUT_BUFFER], arg ptr[in, kbase_hwcnt_reader_metadata]) |
| ioctl$KBASE_HWCNT_READER_SET_INTERVAL(fd fd_hwcnt, cmd const[KBASE_HWCNT_READER_SET_INTERVAL], arg intptr) |
| ioctl$KBASE_HWCNT_READER_ENABLE_EVENT(fd fd_hwcnt, cmd const[KBASE_HWCNT_READER_ENABLE_EVENT], arg const[0]) |
| ioctl$KBASE_HWCNT_READER_DISABLE_EVENT(fd fd_hwcnt, cmd const[KBASE_HWCNT_READER_DISABLE_EVENT], arg const[0]) |
| ioctl$KBASE_HWCNT_READER_GET_API_VERSION(fd fd_hwcnt, cmd const[KBASE_HWCNT_READER_GET_API_VERSION], arg const[0]) |
| |
| type base_atom_id int8 |
| |
| base_jd_atom_v2 { |
| jc int64 |
| udata base_jd_udata |
| extres_list int64 |
| nr_extres int16 |
| compat_core_req int16 |
| pre_dep array[base_dependency, 2] |
| atom_number base_atom_id |
| prio flags[base_jd_prio, int8] |
| device_nr int8 |
| jobslot int8 |
| core_req flags[base_jd_core_req, int32] |
| renderpass_id int8 |
| padding array[const[0, int8], 7] |
| } |
| |
| base_dependency { |
| atom_id base_atom_id |
| dependency_type flags[base_jd_dep_type, int8] |
| } |
| |
| base_jd_udata { |
| blob array[int64, 2] |
| } |
| |
| kbase_ioctl_job_submit { |
| addr ptr64[out, array[base_jd_atom_v2]] |
| nr_atoms len[addr, int32] |
| # sizeof(base_jd_atom_v2) |
| stride const[56, int32] |
| } |
| |
| kbase_ioctl_soft_event_update { |
| event gpu_addr |
| new_status int32 |
| flags const[0, int32] |
| } |
| |
| kbase_ioctl_version_check { |
| major int16 |
| minor int16 |
| } |
| |
| kbase_ioctl_set_flags { |
| create_flags flags[basep_context_create_kernel_flags, int32] |
| } |
| |
| kbase_ioctl_get_gpuprops { |
| buffer ptr64[out, array[int8]] |
| size len[buffer, int32] |
| flags const[0, int32] |
| } |
| |
| kbase_ioctl_mem_alloc { |
| va_pages int64 |
| commit_pages int64 |
| extent int64 |
| flags flags[base_mem_alloc_flags, int64] |
| out_flags int64 (out_overlay) |
| gpu_va gpu_addr |
| } |
| |
| kbase_ioctl_mem_query { |
| gpu_addr gpu_addr |
| query flags[kbase_ioctl_mem_query_flags, int64] |
| value int64 (out_overlay) |
| } |
| |
| kbase_ioctl_mem_free { |
| gpu_addr gpu_addr |
| } |
| |
| kbase_ioctl_hwcnt_reader_setup { |
| buffer_count int32 |
| jm_bm int32 |
| shader_bm int32 |
| tiler_bm int32 |
| mmu_l2_bm int32 |
| } |
| |
| kbase_ioctl_hwcnt_enable { |
| dump_buffer gpu_addr |
| jm_bm int32 |
| shader_bm int32 |
| tiler_bm int32 |
| mmu_l2_bm int32 |
| } |
| |
| kbase_ioctl_hwcnt_values { |
| data ptr64[out, array[int8]] |
| size len[data, int32] |
| padding const[0, int32] |
| } |
| |
| kbase_ioctl_disjoint_query { |
| counter int32 |
| } |
| |
| kbase_ioctl_get_ddk_version { |
| version_buffer ptr64[out, array[int8]] |
| size len[version_buffer, int32] |
| padding const[0, int32] |
| } |
| |
| kbase_ioctl_mem_jit_init_10_2 { |
| va_pages int64 |
| } |
| |
| kbase_ioctl_mem_jit_init_11_5 { |
| va_pages int64 |
| max_allocations int8 |
| trim_level int8 |
| group_id int8 |
| padding array[const[0, int8], 5] |
| } |
| |
| kbase_ioctl_mem_jit_init { |
| va_pages int64 |
| max_allocations int8 |
| trim_level int8 |
| group_id int8 |
| padding array[const[0, int8], 5] |
| phys_pages int64 |
| } |
| |
| kbase_ioctl_mem_sync { |
| handle gpu_addr |
| user_addr user_addr |
| size int64 |
| type flags[base_syncset_op_flags, int8] |
| padding array[const[0, int8], 7] |
| } |
| |
| kbase_ioctl_mem_find_cpu_offset { |
| gpu_addr gpu_addr |
| cpu_addr user_addr |
| size int64 |
| offset int64 (out_overlay) |
| } |
| |
| kbase_ioctl_get_context_id { |
| id int32 |
| } |
| |
| kbase_ioctl_tlstream_acquire { |
| flags int32 |
| } |
| |
| kbase_ioctl_mem_commit { |
| gpu_addr gpu_addr |
| pages int64 |
| } |
| |
| kbase_ioctl_mem_alias { |
| flags flags[base_mem_alloc_flags, int64] |
| stride int64 |
| nents len[aliasing_info, int64] |
| aliasing_info ptr64[in, array[base_mem_aliasing_info]] |
| |
| out_flags int64 (out_overlay) |
| gpu_va gpu_addr |
| va_pages int64 |
| } |
| |
| base_mem_aliasing_info { |
| handle gpu_addr |
| offset int64 |
| length int64 |
| } |
| |
| kbase_ioctl_mem_import { |
| flags flags[base_mem_alloc_flags, int64] |
| phandle int64 |
| type flags[base_mem_import_type, int32] |
| padding const[0, int32] |
| |
| out_flags int64 (out_overlay) |
| gpu_va gpu_addr |
| va_pages int64 |
| } |
| |
| kbase_ioctl_mem_flags_change { |
| gpu_va gpu_addr |
| flags flags[base_mem_alloc_flags, int64] |
| mask int64 |
| } |
| |
| kbase_ioctl_stream_create { |
| name array[int8, 32] |
| } |
| |
| kbase_ioctl_fence_validate { |
| fd fd_fence |
| } |
| |
| kbase_ioctl_mem_profile_add { |
| buffer ptr64[in, array[int8]] |
| len len[buffer, int32] |
| padding const[0, int32] |
| } |
| |
| kbase_ioctl_sticky_resource_map { |
| count len[address, int64] |
| address ptr64[in, array[int64]] |
| } |
| |
| kbase_ioctl_sticky_resource_unmap { |
| count len[address, int64] |
| address ptr64[in, array[int64]] |
| } |
| |
| kbase_ioctl_mem_find_gpu_start_and_offset { |
| gpu_addr gpu_addr |
| size int64 |
| start gpu_addr (out_overlay) |
| offset int64 |
| } |
| |
| kbase_ioctl_mem_exec_init { |
| va_pages int64 |
| } |
| |
| kbase_ioctl_get_cpu_gpu_timeinfo { |
| request_flags flags[base_timerequest_allowed_flags, int32] |
| paddings array[const[0, int8], 7] |
| sec int64 (out_overlay) |
| nsec int32 |
| padding int32 |
| timestamp int64 |
| cycle_counter int64 |
| } |
| |
| kbase_hwcnt_reader_metadata { |
| timestamp int64 |
| event_id int32 |
| buffer_idx int32 |
| } |
| |
| base_jd_dep_type = BASE_JD_DEP_TYPE_INVALID, BASE_JD_DEP_TYPE_DATA, BASE_JD_DEP_TYPE_ORDER |
| base_jd_prio = BASE_JD_PRIO_MEDIUM, BASE_JD_PRIO_HIGH, BASE_JD_PRIO_LOW |
| base_jd_core_req = BASE_JD_REQ_DEP, BASE_JD_REQ_FS, BASE_JD_REQ_CS, BASE_JD_REQ_T, BASE_JD_REQ_CF, BASE_JD_REQ_V, BASE_JD_REQ_FS_AFBC, BASE_JD_REQ_EVENT_COALESCE, BASE_JD_REQ_COHERENT_GROUP, BASE_JD_REQ_PERMON, BASE_JD_REQ_EXTERNAL_RESOURCES, BASE_JD_REQ_SOFT_JOB, BASE_JD_REQ_ONLY_COMPUTE, BASE_JD_REQ_SPECIFIC_COHERENT_GROUP, BASE_JD_REQ_EVENT_ONLY_ON_FAILURE, BASE_JD_REQ_SKIP_CACHE_START, BASE_JD_REQ_SKIP_CACHE_END, BASE_JD_REQ_JOB_SLOT, BASE_JD_REQ_START_RENDERPASS, BASE_JD_REQ_END_RENDERPASS |
| kbase_ioctl_mem_query_flags = KBASE_MEM_QUERY_COMMIT_SIZE, KBASE_MEM_QUERY_VA_SIZE, KBASE_MEM_QUERY_FLAGS |
| base_syncset_op_flags = BASE_SYNCSET_OP_MSYNC, BASE_SYNCSET_OP_CSYNC |
| # 0x400000-0x2000000 are individual bits of BASE_MEM_GROUP_ID_MASK |
| base_mem_alloc_flags = BASE_MEM_PROT_CPU_RD, BASE_MEM_PROT_CPU_WR, BASE_MEM_PROT_GPU_RD, BASE_MEM_PROT_GPU_WR, BASE_MEM_PROT_GPU_EX, BASEP_MEM_PERMANENT_KERNEL_MAPPING, BASE_MEM_GPU_VA_SAME_4GB_PAGE, BASEP_MEM_NO_USER_FREE, BASE_MEM_RESERVED_BIT_8, BASE_MEM_GROW_ON_GPF, BASE_MEM_COHERENT_SYSTEM, BASE_MEM_COHERENT_LOCAL, BASE_MEM_CACHED_CPU, BASE_MEM_SAME_VA, BASE_MEM_NEED_MMAP, BASE_MEM_COHERENT_SYSTEM_REQUIRED, BASE_MEM_PROTECTED, BASE_MEM_DONT_NEED, BASE_MEM_IMPORT_SHARED, BASE_MEM_RESERVED_BIT_19, BASE_MEM_TILER_ALIGN_TOP_EXTENT_MAX_PAGES, BASE_MEM_TILER_ALIGN_TOP, BASE_MEM_UNCACHED_GPU, 0x400000, 0x800000, 0x1000000, 0x2000000, BASE_MEM_IMPORT_SYNC_ON_MAP_UNMAP, BASE_MEM_FLAG_MAP_FIXED |
| base_mem_import_type = BASE_MEM_IMPORT_TYPE_INVALID, BASE_MEM_IMPORT_TYPE_UMM, BASE_MEM_IMPORT_TYPE_USER_BUFFER |
| # 0x08-0x20 are individual bits of BASEP_CONTEXT_MMU_GROUP_ID_MASK |
| basep_context_create_kernel_flags = BASE_CONTEXT_SYSTEM_MONITOR_SUBMIT_DISABLED, 0x8, 0x10, 0x20, 0x40 |
| base_timerequest_allowed_flags = BASE_TIMEINFO_MONOTONIC_FLAG, BASE_TIMEINFO_TIMESTAMP_FLAG, BASE_TIMEINFO_CYCLE_COUNTER_FLAG, BASE_TIMEINFO_KERNEL_SOURCE_FLAG, BASE_TIMEINFO_USER_SOURCE_FLAG |